mlsanityData to 7 Oct 2026

Detecting Backdoors During the Inference Stage Based on Corruption Robustness Consistency

arXiv 2303.18191 ↗First posted 27 Mar 2023cs.CR cs.AI cs.LGcited by 45

Not on the map. Why?

Cited by 21 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Deep neural networks are proven to be vulnerable to backdoor attacks. Detecting the trigger samples during the inference stage, i.e., the test-time trigger sample detection, can prevent the backdoor from being triggered. However, existing detection methods often require the defenders to have high accessibility to victim models, extra clean data, or knowledge about the appearance of backdoor triggers, limiting their practicality. In this paper, we propose the test-time corruption robustness consistency evaluation (TeCo), a novel test-time trigger sample detection method that only needs the hard-label outputs of the victim models without any extra information. Our journey begins with the intriguing observation that the backdoor-infected models have similar performance across different image corruptions for the clean images, but perform discrepantly for the trigger samples. Based on this phenomenon, we design TeCo to evaluate test-time robustness consistency by calculating the deviation of severity that leads to predictions' transition across different corruptions. Extensive experiments demonstrate that compared with state-of-the-art defenses, which even require either certain information about the trigger types or accessibility of clean data, TeCo outperforms them on different backdoor attacks, datasets, and model architectures, enjoying a higher AUROC by 10% and 5 times of stability.

Key facts. Cited by 45 papers in the map (data through 7 Oct 2026). Builds on 32 of its 50 references that are in the map. First posted on arXiv 27 Mar 2023.

Builds on

32 of 50 references.

References · 32

  1. 2021Swin Transformer: Hierarchical Vision Transformer using Shifted Windowscited by 12,082
  2. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
  3. 2016Wide Residual Networkscited by 3,057
  4. 2019Benchmarking Neural Network Robustness to Common Corruptions and Perturbationscited by 2,857
  5. 2016Identity Mappings in Deep Residual Networkscited by 1,960
  6. 2020Shortcut Learning in Deep Neural Networkscited by 1,928
  7. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  8. 2021MobileViT: Light-weight, General-purpose, and Mobile-friendly Vision Transformercited by 636
  9. 2018Spectral Signatures in Backdoor Attackscited by 457
  10. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 437
  11. 2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 429
  12. 2020Backdoor Learning: A Surveycited by 412
20 more
  1. 2020Invisible Backdoor Attack with Sample-Specific Triggerscited by 338
  2. 2020Input-Aware Dynamic Backdoor Attackcited by 304
  3. 2019Detecting AI Trojans Using Meta Neural Analysiscited by 192
  4. 2021Rethinking the Backdoor Attacks' Triggers: A Frequency Perspectivecited by 155
  5. 2020Dynamic Backdoor Attacks Against Machine Learning Modelscited by 147
  6. 2022BackdoorBench: A Comprehensive Benchmark of Backdoor Learningcited by 124
  7. 2021SPECTRE: Defending Against Backdoor Attacks Using Robust Statisticscited by 123
  8. 2019Demon in the Variant: Statistical Analysis of DNNs for Robust Backdoor Contamination Detectioncited by 121
  9. 2021Sleeper Agent: Scalable Hidden Trigger Backdoors for Neural Networks Trained from Scratchcited by 98
  10. 2019Robust Anomaly Detection and Backdoor Attack Detection Via Differential Privacycited by 93
  11. 2020Rethinking the Trigger of Backdoor Attackcited by 76
  12. 2020DeepSweep: An Evaluation Framework for Mitigating DNN Backdoor Attacks using Data Augmentationcited by 75
  13. 2021Black-box Detection of Backdoor Attacks with Limited Information and Datacited by 71
  14. 2022The "Beatrix'' Resurrections: Robust Backdoor Detection via Gram Matricescited by 62
  15. 2019Model Agnostic Defence against Backdoor Attacks in Machine Learningcited by 52
  16. 2021AEVA: Black-box Backdoor Detection Using Adversarial Extreme Value Analysiscited by 52
  17. 2022BadHash: Invisible Backdoor Attacks against Deep Hashing with Clean Labelcited by 28
  18. 2020Can We Mitigate Backdoor Attack Using Adversarial Detection Methods?cited by 8
  19. 2022Towards Effective and Robust Neural Trojan Defenses via Input Filteringcited by 7
  20. 2022An Adaptive Black-box Defense against Trojan Attacks (TrojDef)cited by 5

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 4; 2024: 15; 2025: 13; 2026: 13.

45 papers.

Sort:

By area:

  1. 2023BadCLIP: Trigger-Aware Prompt Learning for Backdoor Attacks on CLIPcited by 63
  2. 2023Pre-trained Trojan Attacks for Visual Recognitioncited by 38
  3. 2024IBD-PSC: Input-level Backdoor Detection via Parameter-oriented Scaling Consistencycited by 38
  4. 2024BackdoorBench: A Comprehensive Benchmark and Analysis of Backdoor Learningcited by 17
  5. 2023Defenses in Adversarial Machine Learning: A Surveycited by 14
  6. 2024UFID: A Unified Framework for Input-level Backdoor Detection on Diffusion Modelscited by 14
  7. 2025Test-Time Backdoor Detection for Object Detection Modelscited by 14
  8. 2023Progressive Poisoned Data Isolation for Training-time Backdoor Defensecited by 10
  9. 2024ECLIPSE: Expunging Clean-label Indiscriminate Poisons via Sparse Diffusion Purificationcited by 9
  10. 2024Unlearnable Examples Detection via Iterative Filteringcited by 9
  11. 2025Efficient Input-level Backdoor Defense on Text-to-Image Synthesis via Neuron Activation Variationcited by 8
  12. 2024Not All Prompts Are Secure: A Switchable Backdoor Attack Against Pre-trained Vision Transformerscited by 5
33 more
  1. 2024Test-Time Multimodal Backdoor Detection by Contrastive Promptingcited by 5
  2. 2026Test-Time Attention Purification for Backdoored Large Vision Language Modelscited by 5
  3. 2024Model X-ray:Detecting Backdoored Models via Decision Boundarycited by 3
  4. 2025Secure Transfer Learning: Training Clean Models Against Backdoor in (Both) Pre-trained Encoders and Downstream Datasetscited by 3
  5. 2026From Internal Diagnosis to External Auditing: A VLM-Driven Paradigm for Data-Free Online Backdoor Defensecited by 3
  6. 2024On the (In)feasibility of ML Backdoor Detection as an Hypothesis Testing Problemcited by 2
  7. 2025SifterNet: A Generalized and Model-Agnostic Trigger Purification Approachcited by 2
  8. 2025TED++: Submanifold-Aware Backdoor Detection via Layerwise Tubular-Neighbourhood Screeningcited by 2
  9. 2026BadCLIP++: Stealthy and Persistent Backdoors in Multimodal Contrastive Learningcited by 2
  10. 2024Game of Trojans: Adaptive Adversaries Against Output-based Trojaned-Model Detectorscited by 1
  11. 2024Detector Collapse: Physical-World Backdooring Object Detection to Catastrophic Overload or Blindness in Autonomous Drivingcited by 1
  12. 2024Prompting the Unseen: Detecting Hidden Backdoors in Black-Box Modelscited by 1
  13. 2025VisMoDAl: Visual Analytics for Evaluating and Improving Corruption Robustness of Vision-Language Modelscited by 1
  14. 2026AI Security in the Foundation Model Era: A Comprehensive Survey from a Unified Perspectivecited by 1
  15. 2026Mechanistic Anomaly Detection via Functional Attributioncited by 1
  16. 2024BackdoorBench: A Comprehensive Benchmark and Analysis of Backdoor Learningcited by 0
  17. 2024Defending Against Repetitive Backdoor Attacks on Semi-supervised Learning through Lens of Rate-Distortion-Perception Trade-offcited by 0
  18. 2024BeniFul: Backdoor Defense via Middle Feature Analysis for Deep Neural Networkscited by 0
  19. 2025TED-LaST: Towards Robust Backdoor Defense Against Adaptive Attackscited by 0
  20. 2025ConSeg: Contextual Backdoor Attack Against Semantic Segmentationcited by 0
  21. 2025Backdoor Samples Detection Based on Perturbation Discrepancy Consistency in Pre-trained Language Modelscited by 0
  22. 2025HAMLOCK: HArdware-Model LOgically Combined attacKcited by 0
  23. 2025Unveiling Hidden Threats: Using Fractal Triggers to Boost Stealthiness of Distributed Backdoor Attacks in Federated Learningcited by 0
  24. 2025MedFedPure: A Medical Federated Framework with MAE-based Detection and Diffusion Purification for Inference-Time Attackscited by 0
  25. 2025The Eminence in Shadow: Exploiting Feature Boundary Ambiguity for Robust Backdoor Attackscited by 0
  26. 2026Backdoor Sentinel: Detecting and Detoxifying Backdoors in Diffusion Models via Temporal Noise Consistencycited by 0
  27. 2026STEP: Detecting Audio Backdoor Attacks via Stability-based Trigger Exposure Profilingcited by 0
  28. 2026CLIP-Inspector: Model-Level Backdoor Detection for Prompt-Tuned CLIP via OOD Trigger Inversioncited by 0
  29. 2026Fast and Lightweight Backdoor Detection via Head Random Probingcited by 0
  30. 2026TimeGuard: Channel-wise Pool Training for Backdoor Defense in Time Series Forecastingcited by 0
  31. 2026Lilith: Backdoor Generalization under Training-Inference Trigger Shiftcited by 0
  32. 2026ToxScreen: Detecting Whether an LLM Has Been Poisonedcited by 0
  33. 2026Beyond Small Patches: Black-Box Detection and Purification of Diverse Backdoor Triggerscited by 0